Abstract Argumentation has been proved as a simple yet powerful approach to manage con icts in reasoning with the purpose to nd subsets of \surviving" arguments. Our intent is to exploit such form of resolution to visually support the administration of security in complex systems. For instance, in case threat countermeasures are in con ict (also with assets) and only some of them can be selected.
An Abstract Argumentation Framework (AAF ), or System, as introduced in a
seminal paper by Dung [
In this work, our goal is to start developing a tool to visualise security threats and related countermeasures as arguments, as if security was a continuous dynamic discussion between the administrator and the surveilled system. Existing automated tools to defend a system from such security threats are one potential solution, but a completely automated approach could undervalue the strong analytic capabilities of humans, particularly in problematic situations that require vigilant human oversight.
We measure the strength of subsets of arguments and single arguments in
accordance with Argumentation Theory. We print such strength degrees in di
erent colours with the purpose to immediately catch the attention of the Security
Administrator on what is going on in his system, and help him to take a decision
on the set of countermeasures to be considered.
In this section we brie y summarise the background information related to
classical Abstract Argumentation Frameworks (AAFs) [
De nition 1 (AAF). An Abstract Argumentation Framework (AAF) is a pair F = hA; Ri of a set A of arguments and a binary relation R A A, called the attack relation. 8a; b 2 A, aR b (or, a b) means that a attacks b. An AAF may be represented by a directed graph whose nodes are arguments and edges represent the attack relation. A set of arguments S A attacks an argument a, i.e., S a, if a is attacked by an argument of S, i.e., 9b 2 S:b a. An argument a 2 A is defended (in F ) by a set S A if for each b 2 A, such that b a, also S b holds.
Argumentation semantics [
De nition 2 (Semantics [
We also recall that the requirements in Def. 2 de ne an inclusion hierarchy on the corresponding extensions, from the most to the least stringent: stb(F ) prf (F ) com(F ) adm(F ). Moreover, (F ) 6= ; always holds for each considered semantics (except for the stable one).
De nition 3 (Arguments acceptance-state). Given one of the semantics in Def. 2 and a framework F , an argument a is i) sceptically accepted if 8S 2 (F ); a 2 S, ii) a is credulously accepted if 9S 2 (F ); a 2 S and a is not sceptically accepted, and iii) a is rejected if @S 2 (F ); a 2 S.
Consider F = hA; Ri in Fig. 1, with A = fa; b; c; d; eg and R = fa b; c b; c d; d c; d e; e eg. In F we have adm(F ) = f;; fag; fcg; fdg; fa; cg; fa; dgg, com(F ) = ffag; fa; cg; fa; dgg, prf (F ) = ffa; dg; fa; cgg, and stb(F ) = ffa; dgg. Hence, argument a is sceptically accepted in com(F ), prf (F ) and stb(F ), while it is only credulously accepted in adm(F ). 3
Consider a small research and development company. This company cooperates with other (often large) enterprises for the development of complex goods. Such company possesses high-tech knowledge which has to be protected from competitors. The company needs to e ciently use its resources with the purpose to survive in a highly competitive market. In short, the company has the goal (i.e., asset) of ensuring the productivity of operations (QoS).
In this small example, the security-system administrator has identi ed the following threats and related security controls (in square brackets): hacker penetration (HP) [host IDS (HI), network IDS (NI)] (where IDS stands for Intrusion Detection System), employee abuse (EA) [monitoring functionality (MF), audit procedures (AP)], and compromise of communication channel (CCC) [virtual private network (VPN), encrypted line (EL)].
We would like to emphasise that abstract arguments have no internal structure, and are not \directly linked" to classical logic. For this reason, we can consider multiple sources of information but and belief, such as case law, common sense, and expert opinion. We can consider information coming from multiple network-sensors, in the form of logs, warnings, and errors. Facts and beliefs can be also taken from internal policy documents, and standard documents as well. For instance the Standard of Good Practice for Information Security, is a business-focused, practical and comprehensive guide to identifying and managing information security risks in organizations and their supply chains. The 2011 Standard is aligned with the requirements for an Information Security Management System (ISMS) set out in ISO/IEC 27000-series standards, and provides wider and deeper coverage of ISOIEC 270023 control topics, as well as cloud computing, information leakage, consumer devices and security governance.
To work on our example we use SecArg 4 (Security with Arguments). SecArg
is based on ConArg [
A more extended example is represented in Fig. 2. In such AAF we have that executing a host IDS and a monitoring functionality on the same machine (i.e., HI&MF) impacts on its QoS. Hence, we pose an attack between them, and we also consider not having HI (NotHI) or MF (NotMF). Moreover, we have some countermeasures in con ict, i.e., EL or VPN, and MF.
We obtain three stable extensions (we use the stable semantics because it is the most sceptical one, see Sec. 2): i) fAP, VPN, EL, HI, NI, NotMF, QoSg, ii) fAP, VPN, EL, HI, NI, HI&MFg, and iii) fAP, VPN, EL, NI, NotHI, NotMF, QoSg. In this case, reasoning in terms of stable or preferred semantics is the same, since they both returns the same three extensions. Reasoning on the scep3 ISO, ISO, and I. E. C. Std. \ISO 27002: 2005.\ Information Technology-Security Techniques-Code of Practice for Information Security Management. ISO (2005). 4 http://www.dmi.unipg.it/secarg 5 http://www.gecode.org tical acceptance of arguments in such three extensions, we obtain that AP, VPN, EL, NI are sceptically accepted (i.e., \always"). This means that, for the attack/countermeasure scenario we have depicted, having audit procedures, a virtual private network, an encrypted line, and a network IDS is always considered a valid argument. Therefore, they correspond to a strong suggestion for the security administrator. On the other hand, there are some other arguments that are rejected (see Def. 3), that is they never appear in such extensions; for instance EA, HP, MF, and CCC. All three threats are successfully \avoided", in the sense that adopted security countermeasures always prevent all of them. Moreover, also adopting the monitoring functionality countermeasure is not a good idea given this scenario, since it is rejected as well. Finally, the remaining arguments appear sometimes but not always in such three extensions (they are credulously accepted, according to Def. 3): NotHI (in 1 extension), HI&MF (1), HI (2), NotMF (2), QoS (2). The number of times they appear is visually highlighted in SecArg by lling arguments with di erent shades of grey, and also returning the appearance ratio, e.g,. 66.6% for QoS and 33.3% for NotHI. This can be interpreted as a strength-score for these arguments: for instance, having an host IDS beats not having it (2 to 1): hence the administrator is recommended to use it. For the sake of presentation, in Fig. 3 we use thick continuous circles for sceptically accepted arguments, thin/thick dotted circles for credulously accepted ones (respectively for lower/higher ratio of appearance, e.g., QoS is thicker than NotHI), and light-grey circles for rejected arguments. 4
Since the application of Argumentation to Cybersecurity-related issues is relatively a new eld (or, at least, not deeply investigated), there is a few related work to be mentioned. A bunch of works applying Argumentation-based con ictresolution to the speci c case of rewall rules are [1{3]. In our approach, however, we would like to provide a general reasoning-tool.
In [
In [
In the next future we would like to extend SecArg from both the theoretical and practical point of view by i) interactively changing the AAF with a new node or attack and immediately see how much such modi cation impacts on the strength of arguments; ii) selecting a subset S of arguments and get the minimal amount of change to the AAF that transforms S into an extension satisfying a given semantics (e.g., preferred).